What there is to know
- The Supreme Court handed down a judgment on Friday affirming that IP addresses, the “key giving access to the activity” of Internet users, are of an “eminently private” nature.
- The fact that police officers consult them as part of investigations constitutes a “search” within the meaning of the law.
- The ruling will likely force investigators to obtain warrants earlier in their investigations.
In a close five-to-four decision, the Supreme Court ruled that an Internet user’s IP address can reveal information that is of an “eminently private nature” justifying it being protected against “unreasonable searches and seizures.”
What is an IP address?
Each device capable of connecting to a computer server or a website has an IP address, that is to say a unique identification number making the transfer of data possible. At each connection, the IP address is automatically noted in a register. “It is the key giving access to a user’s internet activity and, ultimately, to their identity,” underlines the judgment.
How do the police use it?
The case the Supreme Court ruled on concerns a Calgary man whose home police found in 2017 tools for producing fake credit cards. From the start of the investigation, the company Moneris, which managed the credit card transactions of a liquor store targeted by the fraudster, voluntarily disclosed two suspicious IP addresses to the police. The police then obtained a disclosure warrant from a judge forcing the internet service provider Telus to reveal to them the residential address of the account linked to this IP address.
What does the Supreme Court’s decision change?
The Supreme Court’s decision rules that obtaining the IP address from Moneris without first obtaining a warrant is a violation of the suspect’s reasonable expectations of privacy. The decision orders a new trial and will set a precedent. “For the majority of investigations, this will add a step upstream,” forcing the police to go to a judge to obtain a warrant in order to obtain suspicious IP addresses, specifies M.e Laura Ellyson, who teaches the certificate in cyber investigation at Polytechnique Montréal.
PHOTO ALAIN ROBERGE, LA PRESSE ARCHIVES
The Supreme Court, in Ottawa
What will be the impact?
This additional step represents a “certain burden for a judge and for police resources” to process requests, indicates M.e Ellyson, but “it’s not a very big burden,” she believes. At this stage, the police must only demonstrate “reasonable suspicion”, a proof that is relatively easy to do compared to that required for an application for a search warrant or wiretap, for example.
“The Court made a conservative decision” which could “monopolize the judges” and put obstacles in the way of the police “for certain very serious issues, for example cases of child pornography,” fears lawyer Eloïse Gratton. , specialist in privacy issues at BLG.
Significant divergence
Four of the nine justices, including Chief Justice Richard Wagner, dissented, holding instead that “all an IP address reveals to police is a user’s internet service provider – which hardly constitutes a element of a particularly private nature”.
According to Me Ellyson, the majority judgment, however, has a broader scope which limits the ability of police officers to “fish in databases” of massive IP addresses and to use artificial intelligence to “identify patterns and behaviors which are very revealing of people’s way of life,” she emphasizes.